Skip to contentSkip to conversation

crypto: essiv: fix use-after-free in AEAD path

PATCH In review Jérémy Jean 2 participants 2 messages Oct 16 – Nov 4

Subsystems (2)
Stable branch Crypto API
lore
Share & tools
lore

Jérémy Jean

author
#0 lore raw

PATCH v3 1/1 crypto: essiv: fix use-after-free in AEAD path

The request that ESSIV submits to its wrapped AEAD transform may finish before crypto_aead_encrypt() or crypto_aead_decrypt() returns. In case this happens, essiv_aead_done() calls aead_request_complete() on the original ESSIV request, which can end up freeing the request before essiv_aead_crypt() resumes, creating a UAF:

  BUG: KASAN: slab-use-after-free in essiv_aead_crypt+0x8e6/0x950
  Read of size 8 at addr ffff888102af1360 by task init/66

Check the return status before dereferencing rctx after submitting that request. If the operation did not return -EINPROGRESS or -EBUSY, then the request cannot have been freed yet.

Fixes be1eb7f78aa8 ("crypto: essiv - create wrapper template for ESSIV generation")
Cc [email protected]
Assisted-by LLM
Signed-off-by Jérémy Jean <[email protected]>

---

Changes in v3:
- Code simplification.

Changes in v2:
- Drop the local assoc variable and check the return status before dereferencing rctx, as requested by Herbert Xu.

v1: https://lore.kernel.org/linux-crypto/[email protected]/
v2: https://lore.kernel.org/linux-crypto/[email protected]/

 crypto/essiv.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
crypto/essiv.c +2 -2
index a47a3eab6935..3505b2769d93 100644
@@ -250,7 +250,7 @@ static int essiv_aead_crypt(struct aead_request *req, bool enc)
 	err = enc ? crypto_aead_encrypt(subreq) :
 		    crypto_aead_decrypt(subreq);
 
-	if (rctx->assoc && err != -EINPROGRESS && err != -EBUSY)
-		kfree(rctx->assoc);
+	if (err != -EINPROGRESS && err != -EBUSY)
+		kfree(rctx->assoc);
 	return err;
 }
Signature · 1 line
2.47.3
maintainer
#1 lore raw
Quoted 26 lines · Jérémy Jean

The request that ESSIV submits to its wrapped AEAD transform may finish before crypto_aead_encrypt() or crypto_aead_decrypt() returns. In case this happens, essiv_aead_done() calls aead_request_complete() on the original ESSIV request, which can end up freeing the request before essiv_aead_crypt() resumes, creating a UAF:

  BUG: KASAN: slab-use-after-free in essiv_aead_crypt+0x8e6/0x950
  Read of size 8 at addr ffff888102af1360 by task init/66

Check the return status before dereferencing rctx after submitting that request. If the operation did not return -EINPROGRESS or -EBUSY, then the request cannot have been freed yet.

Fixes be1eb7f78aa8 ("crypto: essiv - create wrapper template for ESSIV generation")
Cc [email protected]
Assisted-by LLM
Signed-off-by Jérémy Jean <[email protected]>

---

Changes in v3:
- Code simplification.

Changes in v2:
- Drop the local assoc variable and check the return status before dereferencing rctx, as requested by Herbert Xu.

Quoted 5 lines

v1: https://lore.kernel.org/linux-crypto/[email protected]/
v2: https://lore.kernel.org/linux-crypto/[email protected]/

 crypto/essiv.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Patch applied. Thanks.

Signature · 3 lines
Email: Herbert Xu <[email protected]>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt